CVE-2026-116197

Low

Description

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

SeverityLow

CVSS2.6

Exploit probability—

ProductEdgelesssys Contrast

PublishedOct 25, 2026

First seenOct 25, 2026

Weakness typeCWE-1289CWE-1289

How to fix

Update

edgelesssys contrast1.25.0 or later

Vendor advisories

github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr

Affected products

Product	Affected versions	Fixed in
edgelesssys contrast	1.21.0 ≤ v < 1.25.0	1.25.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.